@lucideproxy/svg@0.0.69
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a high-risk browser proxy capability and opaque runtime behavior, but not a concrete npm install-time attack or proven theft endpoint. It should be warned rather than blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user opens the bundled site and uses its proxy routes.
Impact
Proxied credentials, cookies, request bodies, and browsing metadata can be exposed to the proxy operator.
Mechanism
Service-worker interception and remote proxy forwarding of browser requests.
AI rationale
The source establishes a high-risk browser proxy capability and opaque runtime behavior, but not a concrete npm install-time attack or proven theft endpoint. It should be warned rather than blocked.
Evidence
package.jsonassets/boot-B1PyZHMN-225af2ca.js3zaaw5.jsufb5o/r9k9c1.jsassets/index-D1fEe8Uo-225af2ca.jsindex.htmlufb5o/0w4f46.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a browser proxy bundle despite its SVG-oriented package name.
- Opening the bundled site registers a service worker automatically.
- The worker intercepts routed browser requests and forwards request URLs, headers, and bodies to a controller.
- Large application bundles are deliberately obfuscated, including a dynamic Function constructor.
- This creates a credential and browsing-data exposure capability without any npm install-time hook.
Evidence against
- package.json contains no lifecycle scripts, dependencies, executable entry point, or self-dependency.
- No Node file, environment, shell, or install-time behavior was found.
- The manifest describes the artifact as a static proxy-site bundle, consistent with the browser code.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-225af2ca.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-225af2ca.jsView on unpkg · L134wv2l/p2fs4c.jsView file
17L18: //# sourceURL=${A}`)();n=c,s=l}else n=g.z$,s=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,o=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{o=!0,n=e},call:()=>(o=!0,n=s(...
L19: //# sourceURL=${r.url.href}`),n}return s.body;case"style":return(0,i.sM)(await s.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await s.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
4wv2l/p2fs4c.jsView on unpkg · L17assets/GamesPage-I22UP2hV-225af2ca.jsView file
Findings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/GamesPage-I22UP2hV-225af2ca.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-225af2ca.js
MediumSecret Patternassets/livekit-DqpdvE-G-225af2ca.js
MediumDynamic Require4wv2l/p2fs4c.js
MediumNetwork
MediumProtestware
MediumShips Wasm Module4wv2l/c9pwu8.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.69.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.